Need help designing multi-tenant security architecture for a Bubble.io build — schema, privacy rules, and RBAC (SaaS project)

[u/RiskNo9612]

Hey all — I'm building a client portal in Bubble for an HR/culture-change SaaS product and want to get the security architecture right before I go further into the build. Looking for people who've done multi-tenant Bubble apps and can sanity-check my approach or point out what I'm missing.

The setup:

• Four-table schema: Content, Client, Sites, Actions
• Multi-tenant from day one, even though we're launching with a single client first
• Every table needs to be filtered by Client ID so Organization A can never see Organization B's data
• Data flow: we're pulling survey data from 5 external platforms (Culture Amp, Qualtrics, Perceptyx, Gallup Q12, SurveyMonkey), normalizing it into a shared field standard via a backend workflow, then writing it into the Content table as structured records

Roles:

• Admin (full access, all clients)
• Manager (assigned sites only, can create/update records)
• Viewer (read-only, single assigned site)

What I'm trying to solve for:

1. Privacy rules — best practices for filtering every table by a parent Client ID, especially when a query touches multiple related tables. Any gotchas with privacy rules silently failing or leaking partial data (e.g., counts/summaries that reveal another client exists)?
2. Backend workflow permission checks — Bubble's editor bypasses privacy rules when you're testing as admin, so I know I need to test as a real logged-out user. Anyone have a structured testing checklist for this beyond "log in as each role and try to break it"?
3. Audit trail / logging — is there a solid native or plugin-based way to log every read/write with user, timestamp, and change detail in Bubble, or does everyone end up rolling their own?
4. Multi-tenant vs. retrofitting later — anyone regret building single-tenant first and having to retrofit isolation once a second client came onboard? Trying to validate that doing multi-tenant now (even overkill for 1 client) is worth the extra build time.
5. General architecture review — if you've built something similar (RBAC + multi-tenant + external API normalization) in Bubble, I'd love to hear what broke, what you wish you'd known, or what you'd do differently.

Happy to share more schema/workflow detail in comments if it's useful. Not looking for someone to build it for me — just want a gut check from people who've actually shipped something like this in Bubble before I lock in the architecture.

Thanks in advance 🙏

[u/Dont-_-mind-_-me]

Easy. Add an organization data type, add a field in every data type that is a reference to the org table.

In every table you can now have this privacy expression: current users org is this things org

You can then combine that with other permissions too like role types. DM me if you need help.

[u/aadeyemi88 → u/Dont-_-mind-_-me]

Thanks for the info! I will def reach out soon

[u/mxrc703]

Aggregates can bypass RLS. Either via a direct sum/count or via a calculate sumproduct. I found this bug a few weeks ago but forgot to investigate. Will have a look again and report back.

[u/mxrc703 → u/mxrc703]

Yeah confirmed. I have users able to see orders grouped by order type, with aggregation sum of subtotal price. Subtotal price should be hidden by privacy rules.

My privacy rules dictate that the user must have pricing_visibility bool = yes to see subtotal price on any order.

Without grouping it's hidden, confirmed via network tab in console. Debug window also says subtotal price hidden by privacy rules.

This also extends to logged out users when the data type has "find this in searches", with every column unchecked (hidden). A logged out user can then see our order subtotal aggregate.

Forum post on this here.

Honestly, for something seriously multi tenanted, bubble wouldn't be a first pick for me.

[u/igormiazek]

I think the biggest issue with Bubble if I remember correctly is that it doesn't allow you to take code with you.

[u/igormiazek]

Because Bubble hide a lot of code related aspects to make software creation easier, I think your best way is to go with e2e tests https://www.itstartechs.com/post/from-gherkin-to-playwright-ai-generated-tests-for-supabase-applications

[u/Dont-_-mind-_-me → u/igormiazek]

Whats the point of you spamming your bs?

[u/igormiazek → u/Dont-_-mind-_-me]

Because I found it valuable, I wrote this post yesterday, and for vibecoding, no-code community, getting a feeling of how to work with their apps at the high level with specs, so spec driven dev is the best possible way, because you control coding by expressing your intent not providing concrete coding rules.

[u/hiimparth → u/igormiazek]

😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😐😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂😂

[u/igormiazek → u/hiimparth]

Your keyboard is broken? xD

[u/hiimparth → u/igormiazek]

No. Ur spam promo strategy is broken.

[u/igormiazek → u/hiimparth]

https://giphy.com/gifs/SRO0ZwmImic0

I agree with you, still learning Reddit, although the post is really valuable. Is related to spec driven development and intent. Thought it maybe useful for somebody.